Anthropic won, and how it won should worry anyone who thought “national security” was a legal argument. On Thursday, Judge Rita F. Lin of the Northern District of California issued a 59-page order dismantling the Pentagon’s February designation of Anthropic as a supply chain risk. She called it retaliation against a company that publicly refused to let Claude power lethal autonomous weapons without human oversight or mass surveillance of Americans. The blacklist is permanently blocked.
My take after sitting with the ruling is that this case was never about supply chains. It was a test of whether the government can punish a company for stating its ethics out loud, and in Judge Lin’s courtroom the answer is no.
A statute built for foreign adversaries, pointed at San Francisco
Supply chain risk designations exist to keep hostile foreign actors out of defense procurement. The February action against Anthropic was the first time that tool had ever been aimed at a U.S. company. The order works through First Amendment retaliation, Fifth Amendment due process, and the Administrative Procedure Act, and the designation fails all three. That should have ended the conversation in February.
The technical finding is the part I keep coming back to. The government couldn’t identify a single mechanism by which Anthropic could sabotage deployed models. Claude instances running on government systems are static, with no remote access, no kill switch, no hidden channel home. Judge Lin found no evidence of genuine sabotage risk, which means the security rationale didn’t just fail legally. It failed on the physics.
Judge Lin also handed the industry its new favorite sentence, and it spread through AI circles within hours.
The road here was messier than the verdict suggests. Dario Amodei stated the red lines publicly, Hegseth designated the company in February, talks collapsed, and Anthropic sued in March. There was procedural whiplash too, including a denied pause request and a temporary hold earlier this summer.
The contradiction the government never explained
Before the blacklist, Hegseth threatened to invoke the Defense Production Act against Anthropic, a law for compelling companies deemed essential to national security. Then the same company became a supply chain threat. You can’t be both indispensable and dangerous, and while the judge didn’t need that contradiction to rule, it tells you what this fight actually was, a vendor squeezed for leverage and punished when it wouldn’t fold.
There’s a stranger detail getting less attention than it deserves. While one arm of the government was blacklisting Anthropic, other parts were still courting it, including discussions around its upcoming Mythos model. Judge Lin cited that split-brain behavior as evidence the security concern wasn’t genuine. When your lawyers and your procurement office work from opposite playbooks, the national security label stops being an assessment and becomes a mood.
Internal records leaned on Anthropic’s “arrogance,” which tells you what this really was. The designation was deterrence theater, a message to every lab that publishing red lines carries a price. And the government clearly wanted Claude. We charted the company’s $11.5 billion Q2 revenue and its IPO math earlier this month. Nobody burns that much political capital blacklisting a vendor they can easily replace.
What the win doesn’t fix
Keep the celebration measured. The ruling blocks the punishment, not the preference. The Pentagon can still choose other vendors through lawful means, and nobody should expect Claude near weapons systems, because Anthropic doesn’t want that either. What changed is that any future decision has to be a real decision, not a blacklist dressed up as risk management.
The legal story isn’t over. A narrower challenge remains live at the D.C. appeals court on a different statutory basis, and an appeal of the California ruling is expected. Contractors and agencies sit in a compliance gray zone until that resolves, which is its own quiet cost.
And the courts can’t fix the commercial side. Anthropic lost months of government certainty, and every lab watching learned that public red lines are legally defensible but not commercially free. It fits a strange year for tech leverage. Apple is cutting 200 jobs as its Siri and Vision Pro bet gets repriced, while Anthropic just proved that principles backed by good lawyers can survive the state.
For its part, Anthropic says it remains focused on working productively with the government to harness AI for national security. After this ruling, both sides know exactly where the lines sit.
My honest conclusion is that the most important sentence in this ruling has nothing to do with Anthropic. It’s the principle that national security can’t work as a blank check against domestic critics. If you build AI, your red lines are now protected speech. The harder question, the one no judge answers for you, is what you’re willing to lose to keep them.
